Misc

Miscellaneous plugins not yet categorized.

Plugin/FunctionTypeDescription
alertFunctionGenerate an alert message
allFunctionReturns TRUE if all items are true
anyFunctionReturns TRUE if any items are true
base85decodeFunction
client_createFunctionCreate a new client in the data store
create_notebook_downloadFunctionCreates a notebook export zip file
delayPluginExecutes ‘query’ and delays relaying the rows by the specified number of seconds
delete_eventsPluginDelete all the files that make up a flow
delete_flowPluginDelete all the files that make up a flow
efivariablesPluginEnumerate efi variables
entropyFunctionCalculates shannon scale entropy of a string
flow_logsPluginRetrieve the query logs of a flow
get_flowFunctionGets flow details
gunzipFunctionApply Gunzip to the data
hunt_deletePluginDelete a hunt
hunt_updateFunctionUpdate a hunt
leveldbPluginEnumerate all items in a level db database
logscale_uploadPluginUpload rows to LogScale ingestion server
lruFunctionCreates an LRU object
lzxpress_decompressFunctionDecompress an lzxpress blob
mailFunctionSend Email to a remote server
mock_clearFunctionResets all mocks
mock_replayFunctionReplay recorded calls on a mock
monitoring_logsPluginRetrieve log messages from client event monitoring for the specified client id and artifact
orgFunctionReturn the details of the current org
org_createFunctionCreates a new organization
org_deleteFunctionDeletes an Org from the server
orgsPluginRetrieve the list of orgs on this server
passwdFunctionUpdates the user’s password
pe_dumpFunctionDump a PE file from process memory
pk_decryptFunctionDecrypt files using pubkey encryption
pk_encryptFunctionEncrypt files using pubkey encryption
process_trackerFunctionInstall a global process tracker
process_tracker_allFunctionGet all processes stored in the tracker
process_tracker_callchainFunctionGet a call chain from the global process tracker
process_tracker_childrenFunctionGet all children of a process
process_tracker_getFunctionGet a single process from the global tracker
process_tracker_pslistPluginList all processes from the process tracker
process_tracker_treeFunctionGet the full process tree under the process id
process_tracker_updatesPluginGet the process tracker update events from the global process tracker
profile_goroutinesPluginEnumerates all running goroutines
profile_memoryPluginEnumerates all in use memory within the runtime
pskillFunctionKill the specified process
queryPluginEvaluate a VQL query
rekeyFunctionCauses the client to rekey and regenerate a new client ID
remapFunctionApply a remapping configuration to the root scope
repackFunctionRepack and upload a repacked binary or MSI to the server
server_frontend_certFunctionGet Server Frontend Certificate
tlsh_hashFunctionCalculate the tlsh hash of a file
traceFunctionUpload a trace file
upload_azureFunctionUpload files to Azure Blob Storage Service
upload_smbFunctionUpload files using the SMB file share protocol
userFunctionRetrieves information about the Velociraptor user
user_grantFunctionGrants the user the specified roles
vfs_lsPluginList directory and build a VFS object
write_jsonlPluginWrite a query into a JSONL file